This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Cannot start the Windows Event Log service on Local Computer. Error 4201: The instance name passed was not recognized as valid by a WMI data provider.
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Hi Ramesh,
That did the trick. For the record:
Thank you!
Rung
Hi rung_windows7,
Renaming or deleting the following folder seems to work for some users:
C:\Windows\System32\LogFiles\WMI\RtBackup
REF: Event log error 4201 - ERROR_WMI_INSTANCE_NOT_FOUND (a helluva great thread)
Ramesh Srinivasan, Microsoft MVP [Windows Desktop Experience]
I tried various fixes that just wouldn't work from various sources... creating .cmd files from .txt files, reboot in safe mode, ... for months. The whole issue starts when you try to beat the Microsoft UAC system. If you take control of your folders you loose control of this RtBackup folder and Windows may or may not let you make changes at that point. Just follow the directions below and it should fix it.
Here's the simple answer that worked for me:
- Navigate to C:\Windows\System32\LogFiles\WMI\RtBackup
- Right-click on RtBackup and select Properties > Security
- In the list of “Group or user names” is “SYSTEM” listed?
- If not, click Edit > Add . . . and type in “SYSTEM” in the dialog box and click OK.
- Restart your computer
Yep, I also got "access denied no matter what kind of safe mode I booted in, and this worked for me. Happy camper now.
One guess: this must've started after I switched from comcast to at&t and whatever the installer did ( I wasn't at home) messed up event log.
Gentlemen,
First, I want to thank everyone for sharing your knowledge and expertise with the rest of us.
I had the very same issue with Windows server 2008 and was not able to rename the RtBackup folder. After trying all I could to follow on the suggestions here, and kept getting Access denied, I tried something else and it worked. From Windows Safe Mode, under the Administrator account, I took ownership of the WMI directory. That game me access to RtBackup. At this point Windows still won't allow you to rename it, but you can delete the contents, which I did. Rebooted the server and, BOOM DagGammit, it worked.
One more thing I would like to add is that what original issue was that CiscoWorks LMS 4.o just quit working. Of course, one of the first things to do is to check the Event viewer which was not available. By rectifying the Event Viewer issue, it also fixed the Cisco LMS problem. Not sure what the correlation is, but I am determined to find out. If anyone knows why, I would appreciate if you could share your thoughts.
Thanks!
Sam
I can't believe that one has to go through all these steps to get a basic service like event viewer to work. Microsoft engineers can't figure it out and come up with a hotfix for the problem? Doesn't anyone have a clue as to what caused this to happen to so many people for so many years in the first place? I'd think it was one of the numerous updates but how far back could that go? This solution, while typical of the geeky world of computer workarounds makes me nauseous. I'm trying to troubleshoot a system freeze and can't see any of the possible events that could have caused it. How is it that Windows 7 and it's usually superior troubleshooter not catch this problem?
